Last updated: 9 October 2026
This English version is provided for international visitors. The French version shall prevail in case of discrepancy.
This policy explains how BCDG collects and processes personal data from visitors, customers, prospects, newsletter subscribers and users of website forms.
1. Data Controller
The Koinobori House website (koinoborihouse.com) is published and operated by Alain Herbinière, sole trader (entrepreneur individuel), under the BCDG brand, which is also the name of the shop in Le Guilvinec. Alain Herbinière, sole trader, referred to below as “BCDG”, is the data controller.
SIREN / RCS : 945 241 545 R.C.S. Quimper
SIRET (registered office): 945 241 545 00017
BCDG shop address: 34 quater rue de la Marine, 29730 Le Guilvinec, France
Data protection contact email: contact@koinoborihouse.com
No Data Protection Officer is appointed at this stage unless decided otherwise later.
2. Data Collected
Depending on website use, the following data may be collected:
- identity data: first name, last name;
- contact details: email address, postal address, phone number if provided;
- order data: products ordered, quantity, amount, date, order number;
- delivery data: address, country, carrier, tracking;
- billing data: billing address, information required for invoices;
- payment data: payment status, transaction ID, payment provider used; full card details are processed by Stripe or PayPal and are not stored by BCDG;
- customer account data if an account is created;
- messages sent through contact, quote request, B2B/B2G or customer service forms;
- for requests from businesses and institutions: organisation name, position, SIRET or SIREN number, country and city;
- newsletter and consent data;
- technical data: IP address, security logs, browser, language, necessary cookies, language or consent preferences.
3. Purposes and Legal Bases
| Purpose | Legal basis |
|---|---|
| Managing orders, payments, deliveries, returns and customer service | Performance of contract |
| Invoicing, accounting, tax and legal obligations | Legal obligation |
| Managing contact requests, B2B/B2G quotes, public-sector inquiries | Pre-contractual measures or legitimate interest depending on the case |
| Checking the SIRET or SIREN number of businesses and institutions against the public business register | Legitimate interest (making sure the request comes from an existing organisation) |
| Creating and managing customer accounts | Performance of contract (account creation optional at checkout) |
| Website security, fraud prevention, technical logs | Legitimate interest |
| Newsletter | Consent |
| Commercial messages about similar products to existing customers | Legitimate interest, with a simple and free right to object |
| Marketing to non-customer prospects | Consent where required |
| Audience measurement (when enabled) | Consent exemption: Plausible Analytics, without cookies or individual tracking |
4. Newsletter and Marketing
Newsletter subscription is based on consent. Customers may unsubscribe at any time using the link included in each email or by contacting BCDG.
BCDG may send existing customers information or offers about products similar to those already ordered, provided customers have been informed and may object easily and free of charge.
Personal data is not sold to third parties.
5. Recipients and Processors
Data may be shared only where necessary with:
- hosting provider: o2switch (France);
- software stack: WordPress, WooCommerce, Kadence theme, and the following extensions: Polylang and Polylang for WooCommerce (bilingual website), SEOPress (search engine optimisation), LiteSpeed Cache (performance), Fluent Forms (forms), FluentSMTP (email delivery), Complianz (cookie consent management), Wordfence (security), UpdraftPlus (backups), WooCommerce PDF Invoices & Packing Slips (invoices);
- payment providers: Stripe (WooCommerce Stripe Gateway extension) and PayPal (WooCommerce PayPal Payments extension);
- email / SMTP / newsletter provider: Brevo;
- carriers: La Poste / Colissimo; Mondial Relay (France and served European countries);
- analytics tool, when enabled: Plausible Analytics (no cookies, no individual tracking);
- external backup storage: Google Drive (via UpdraftPlus);
- public business register (Recherche d’entreprises API, a French government service): receives only the SIRET or SIREN number entered, for verification;
- technical providers necessary for maintenance, security or website operation;
- administrative or judicial authorities where required by law.
Requests sent through the site’s forms are received in a separate inbox for each audience: individuals, businesses, institutions.
No customer review tool and no abandoned cart tool are used at launch. This policy will be updated if this changes.
6. Transfers Outside the European Union
Some technical or payment providers may involve processing or access from countries outside the European Union (in particular Stripe, PayPal and Google). Where applicable, BCDG ensures that appropriate safeguards are provided by the relevant providers, such as standard contractual clauses, adequacy decisions or additional measures where required. Brevo (France) and Plausible (European Union) host their processing within the European Union.
7. Retention Periods
Data is retained for the following periods, after which it is deleted or anonymised, unless a longer statutory retention obligation applies or a dispute is ongoing:
| Data | Indicative retention period |
|---|---|
| Orders, invoices, accounting documents | 10 years |
| Customer accounts | Account lifetime, then deletion or anonymisation after 3 years of inactivity |
| Simple contact requests | 3 years after the last exchange, unless required for legal reasons or disputes |
| Business and institution requests and quotes not followed by an order (including the SIRET number) | 3 years after the last contact, unless required for legal reasons or disputes |
| Customer marketing data | Duration of the commercial relationship, then 3 years after last active contact |
| Prospect newsletter data | 3 years after last active contact or until consent is withdrawn |
| Proof of objection to marketing | As long as necessary to manage the objection; internal recommendation: at least 3 years |
| Security logs | 12 months |
| Exempted audience measurement cookies, if applicable | Recommended maximum lifetime: 13 months; associated data: maximum 25 months |
8. Individual Rights
Individuals may request access, rectification, erasure, restriction, objection to processing or data portability where applicable.
To exercise these rights: contact@koinoborihouse.com.
Proof of identity may be requested in case of reasonable doubt about the requester’s identity.
Individuals may also lodge a complaint with the French data protection authority, the CNIL.
9. Security
BCDG implements reasonable security measures: secure hosting, restricted access, strong passwords, two-factor authentication on administrator accounts, a dedicated security extension, regular updates of WordPress, WooCommerce and extensions, regular backups (hosting provider and external encrypted backups) and limited access to data.
In the event of a personal data breach likely to result in a risk to the rights and freedoms of individuals, BCDG will notify the CNIL within the conditions and deadlines provided by the regulations and will inform the individuals concerned where required.
10. Minors
The website is not specifically directed at minors. Orders must be placed by a person legally capable of entering into a contract.
11. Changes to This Policy
This policy may be updated to reflect changes to the website, providers or legal requirements.